Freedom of Information Release 43 dated 13/08/20 - Records concerning sales of personal data from 2019 to 2020
Request
I’d like to exercise my rights under the Freedom of Information Act and make a request to know the following:
- Can I please have your records concerning the sales of personal data from 2019 and 2020, including trading partners and money earned from transactions?
- Please can I have your records concerning the determining the price of personal data, for sales and sharing for the time period January 2019- Present.
- What is your internal procedure for selling personal data? By this, I mean guidance given to internal staff and the buyer in question, for the time period of January 2019- Present.
- What types of personal data do you sell and are there any limits placed on this? For the time period of January 2019- Present.
- How many Subject Access Requests did you receive in the period 2017-2020, broken down by year? What types of personal data did they typically receive? For example, email addresses, home addresses and telephone numbers?
Response
The Crown Prosecution Service (CPS) does not engage in the selling of personal data and therefore holds no recorded information pertaining to points one to four.
The CPS holds recorded information pertaining to the number of Subject Access Requests (SARs) received during each calendar year 2017 to 2019 and up to the 31 July 2020. This data can be found in the table below.
The data shown in the table relates to Subject Access Requests made under section 7 of the Data Protection Act (DPA) 1998 and, in line with changes to legislation, section 45 of the DPA 2018 after May 25, 2018.
| Calendar year | Number of requests received |
|---|---|
| 2017 | 251 |
| 2018 | 217 |
| 2019 | 315 |
| 2020 (up to 31/7/20) | 198 |
In order to establish the type of personal information that each requestor received, a manual review of the disclosure provided to each requestor in response to their Subject Access Request would be required.
Section 12(1) of the FOI Act means public authorities are not obliged to comply with a request for information if it estimates the cost of complying would exceed the appropriate limit. The appropriate limit for central government it is set at £600. This represents the estimated cost of one person spending approximately 3.5 working days determining whether the department holds the information, and locating, retrieving and extracting the information.
We believe that the cost of reviewing the number of disclosures provided to each requestor, as indicated by the data shown in the table, would exceed the appropriate limit. Consequently, we are not obliged to comply with this part of point five.